Popular third-party Android app provider Aptoide S.A. has suffered major data breach with the details of 20 million users published on a hacking forum.

The data breach was first discovered by security researchers at Under the Breach and is likely bigger yet, with those behind the hack claiming that they have in total 39 million customer records from Aptoide. The data is said to include personally identifiable information including email address, hashed password, real name, sign-up date, sign-up IP address, device details and date of birth.

9to5Google reported today that the data only related to Aptoide users who signed up between July 21, 2016, and Jan. 28, 2018. The date range suggests that the theft of the data is old even though the publication of the stolen data is new. Aptoide claims to have 150 million users in total.

Aptoide confirmed the hack in a blog post Saturday, though it claimed only email addresses were stolen. The site has closed all new signups as a precaution until a full audit is conducted. As a precaution, Aptoide is also soon going to require all users to set a new password “for security measures.”

It’s nearly a cliche at this point that any provider of Android apps that isn’t Google Play is said to be bad, despite the fact that Google Play itself is often found to be full of malicious apps. Some third-party app stores are better than others and Aptoide was one of the better ones, the fourth most popular Android app provider online rated by apps available, according to Business of Apps.

“It does serve as a reminder though that users should stick to downloads through official app stores and avoid the temptation of downloading apps or other software through unknown third parties, particularly if the download request comes through an email or text message,” Javvad Malik, security awareness advocate at security awareness training company KnowBe4 Inc., told SiliconANGLE

Aptoide is a venture capital-backed startup and has raised $21.7 million in funding. Investors include e.ventures, Portugal Ventures, Gobi Partners and Golden Gate.

Image: Aptoide